.github/workflows/main.yml

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

name: Apache Roller

on:
  push:
    branches: [master, roller-6.1.x]
  pull_request:
    branches: [master, roller-6.1.x, 'feature/**']

jobs:
  build-test:
    name: Build+Test on Linux/JDK ${{ matrix.java }}
    runs-on: ubuntu-latest
    timeout-minutes: 30

    strategy:
      fail-fast: false
      matrix:
        java: [ '17', '21', '25' ]

    steps:
      - name: Set up JDK ${{ matrix.java }}
        uses: actions/setup-java@v6
        with:
          java-version: ${{ matrix.java }}
          distribution: 'zulu'
          # remove after build warning count is reduced
          problem-matcher: false

      - name: Checkout Project
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: false
          show-progress: false

      - name: Build Roller and run JUnit Tests
        run: mvn -V -ntp install

      - name: Publish JUnit Report
        uses: test-summary/action@v2
        if: always()
        with:
          paths: "app/target/surefire-reports/TEST-*.xml"
          show: all
          folded: true

      # only on integration and only once in this matrix
      - name: Upload Dev Build on Integration
        if: ${{ (matrix.java == '17') && (github.event_name == 'push') }}
        uses: actions/upload-artifact@v7
        with:
          name: dev-build
          path: ./app/target/roller.war
          retention-days: 90
          if-no-files-found: error

  # Apache RAT is not bound to the build because it slows it down, so CI runs
  # it on its own
  license-headers:
    name: License headers
    runs-on: ubuntu-latest
    timeout-minutes: 10

    steps:
      - name: Set up JDK 17
        uses: actions/setup-java@v6
        with:
          java-version: '17'
          distribution: 'zulu'

      - name: Checkout Project
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: false
          show-progress: false

      - name: Check license headers with Apache RAT
        run: mvn -V -ntp apache-rat:check

  # Browser tests against Roller's own user database: the new-user journey
  # (register, create a weblog, publish and read an entry). The OIDC tests
  # skip themselves on this instance, and roller.expectedAuth turns any other
  # unexpected skip into a failure.
  ui-tests-db:
    name: UI tests (db)
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Set up JDK 17
        uses: actions/setup-java@v6
        with:
          java-version: '17'
          distribution: 'zulu'

      - name: Checkout Project
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: false
          show-progress: false

      - name: Build Roller
        run: mvn -V -ntp -DskipTests install

      - name: Start Roller with Jetty and Derby
        run: |
          mvn -ntp jetty:run > jetty.log 2>&1 &
          timeout 300 bash -c 'until curl -sf http://localhost:8080/roller/ > /dev/null; do sleep 5; done'

      - name: Install Playwright browser
        working-directory: it-playwright
        run: mvn -ntp test-compile exec:java -Dexec.classpathScope=test -Dexec.mainClass=com.microsoft.playwright.CLI -Dexec.args="install --with-deps chromium"

      - name: Run UI tests
        working-directory: it-playwright
        run: mvn -ntp verify -Droller.expectedAuth=db

      - name: Publish UI Test Report
        uses: test-summary/action@v2
        if: always()
        with:
          paths: "it-playwright/target/failsafe-reports/TEST-*.xml"

      - name: Upload traces and server log
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: ui-tests-db-diagnostics
          path: |
            it-playwright/target/playwright-traces
            jetty.log
            logs/roller.log
          if-no-files-found: ignore

  # Browser tests against the Docker Compose stack (Tomcat + PostgreSQL +
  # Keycloak), once per authentication method the stack supports: pure OIDC,
  # and db-oidc where form login and OIDC are offered side by side. In db-oidc
  # mode every suite runs: the journey registers the first user through the
  # form before OIDC sign-in provisions any accounts.
  ui-tests-oidc:
    name: UI tests (${{ matrix.auth }})
    runs-on: ubuntu-latest
    timeout-minutes: 45

    strategy:
      fail-fast: false
      matrix:
        auth: [ 'oidc', 'db-oidc' ]

    steps:
      - name: Set up JDK 17
        uses: actions/setup-java@v6
        with:
          java-version: '17'
          distribution: 'zulu'

      - name: Checkout Project
        uses: actions/checkout@v7
        with:
          persist-credentials: false
          submodules: false
          show-progress: false

      # Roller discovers Keycloak's endpoints at http://keycloak:9080 and
      # redirects the browser to them, so the runner must resolve the compose
      # hostname too
      - name: Resolve Keycloak's hostname on the runner
        run: echo "127.0.0.1 keycloak" | sudo tee -a /etc/hosts

      - name: Build and start Roller, PostgreSQL and Keycloak
        run: docker compose up -d --build
        env:
          AUTHENTICATION_METHOD: ${{ matrix.auth }}

      # a fresh install waits for the one-time setup token it logs at startup;
      # the tests redeem it and create the database tables in the browser
      - name: Wait for Roller and copy out its log
        run: |
          timeout 300 bash -c 'until curl -sf http://localhost:8080/ > /dev/null; do sleep 5; done'
          docker compose cp apache-roller:/usr/local/tomcat/logs/roller.log roller.log

      - name: Install Playwright browser
        working-directory: it-playwright
        run: mvn -ntp test-compile exec:java -Dexec.classpathScope=test -Dexec.mainClass=com.microsoft.playwright.CLI -Dexec.args="install --with-deps chromium"

      - name: Run UI tests
        working-directory: it-playwright
        run: mvn -ntp verify -Droller.baseUrl=http://localhost:8080/ -Droller.expectedAuth=${{ matrix.auth }} -Droller.test.logFile=${{ github.workspace }}/roller.log

      - name: Publish UI Test Report
        uses: test-summary/action@v2
        if: always()
        with:
          paths: "it-playwright/target/failsafe-reports/TEST-*.xml"

      - name: Collect container logs
        if: failure()
        run: docker compose logs > compose.log

      - name: Upload traces and container logs
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: ui-tests-${{ matrix.auth }}-diagnostics
          path: |
            it-playwright/target/playwright-traces
            compose.log
          if-no-files-found: ignore